The Security Risks of ChatGPT

Issue 2/3 2023 Editor's Choice, Information Security, News & Events, Integrated Solutions, Security Services & Risk Management

ChatGPT, developed by the artificial intelligence lab OpenAI, is a humanoid chatbot causing a global sensation. It is now the fastest growing app in history, hitting 100 million active users in just two months – much faster than the nine months it took previous record-holder TikTok to reach that mark.


Byron Horn-Botha.

This powerful, open-source tool can do whatever you ask, including writing school essays, drafting legal agreements and contracts, solving complex mathematical problems, and passing the medical licensing exam. It also has the potential to revolutionise the way businesses operate. With ChatGPT, you can generate reports quickly and handle customer service requests efficiently. The tool can even write code for your next product offering, conduct market analysis and help build your company website.

Although ChatGPT offers many benefits to businesses, it also poses urgent security questions. One of the critical risks associated with this technology is the power it gives cyber criminals with no coding experience to create and deploy malicious software. With ChatGPT, anyone with bad intentions can quickly develop and unleash malware that wreaks havoc on companies.

Security firm Check Point Research reported that, within weeks of ChatGPT’s release, individuals in cybercrime forums, including those with limited coding skills, used it to create software and emails for espionage, ransomware attacks, and malicious spamming1. Check Point said it is still too early to tell if ChatGPT will become the go-to tool among dark web dwellers. Still, the cybercriminal community has demonstrated a strong interest in ChatGPT and is already using it to develop malicious code.

In one example, reported by Check Point2, a malware creator revealed in a cybercriminal forum that they were using ChatGPT to replicate well-known malware strains and techniques. As evidence, the individual shared the code for a Python-based information stealer that they developed using ChatGPT. The stealer searches, copies, and transfers 12 common file types from a compromised system, including Office documents, PDFs, and images.

Increases everyone’s exposure to hacking.

Bad actors can use ChatGPT and other AI writing tools to make phishing scams more effective. Traditional phishing messages are often easily recognisable because they are written in clumsy English, but ChatGPT can fix this. Mashable tested ChatGPT’s ability by asking it to edit a phishing email. Not only did it quickly improve and refine the language, but it also went a step further and blackmailed the hypothetical recipient without prompting.

While OpenAI says it has strict policies and technical measures to protect user data and privacy, the truth is that these may not be enough. ChatGPT scrapes data from the web, potentially data from your own company, which brings security risks. For instance, data scraping can result in sensitive information, such as trade secrets and financial data exposure to competitors. There can also be reputational damage if the information obtained through data scraping is inaccurate. Moreover, when data is scraped, it can open systems to vulnerabilities that malicious actors can exploit.

Given that the attack surface has dramatically expanded due to the advent of ChatGPT, what impact does this have on your security posture? Previously, small and mid-sized businesses may have felt secure, thinking that they were not worth the trouble of hacking. However, with ChatGPT making creating malicious code at scale easier, everyone’s exposure to cybercrime has significantly increased.

ChatGPT demonstrates that while the number of security tools available to protect you may be increasing, these tools may not be able to keep pace with emerging AI technologies that could increase your vulnerability to security threats. Given the spiralling threat of cybercrime, every business needs to be aware of the potential risks posed by ChatGPT and other advanced AI systems, and take steps to minimise those risks.

Measures you can take to protect yourself.

Your first step is to understand just how vulnerable you are. Penetration testing, also known as pen testing, can help protect your data by simulating a real-world attack on your company’s systems, networks, or applications. This exercise aims to identify security vulnerabilities that malicious actors could exploit so you can close them. By exposing your weaknesses in a controlled environment, pen testing enables you to fix those weaknesses, improve your security posture and reduce the risk of a successful data breach or other cyberattacks. In the new world of ChatGPT, penetration testing can play a crucial role in helping you safeguard your data and ensure its confidentiality, integrity, and availability.

Companies must also double down on their data resilience strategy and have a solid data protection plan. A data resilience plan outlines the steps a business should take to protect its critical data and systems and how it will restore normal operations as quickly and efficiently as possible if a data breach occurs. It also provides a roadmap for responding to cyber threats, including detailed instructions for securing systems, backing up data, and communicating with stakeholders during and after an incident. By putting a data resilience plan in place, businesses can minimise the impact of cyber threats and reduce their risk of data loss, helping to ensure their organisation’s ongoing success and survival.

Another way of stopping ChatGPT-enabled script kiddies and criminals is through immutable data storage. Immutability means data is converted to a write-once, read many times format, and cannot be deleted or altered. There is not any way to reverse the immutability, which ensures that all your backups are secure, accessible, and recoverable. Even if attackers gain full access to your network, they will still not be able to delete the immutable copies of your data or alter the state of that data.

By putting the proper protection in place, organisations can realise the many benefits of ChatGPT, while defending themselves against those who use the tool for malicious purposes.

For more information, contact Arcserve Southern Africa, [email protected], www.arcserve.com

1 www.securitysa.com/*gpt1

2 www.securitysa.com/*gpt2




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Autonomous construction site protection
Editor's Choice Perimeter Security, Alarms & Intruder Detection
Ajax provides an autonomous security solution for a German construction site that is easy and flexible to install. It provides security against intrusions and theft via a 360-degree view.

Read more...
SMART and secure estates in Cape Town
Technews Publishing Axis Communications SA Gallagher DeepAlert Nemtek Electric Fencing Products Editor's Choice
In February 2024, SMART Security Solutions emigrated to the Western Cape to host its first SMART Estate Security Conference in the region in many years. For the day, we took over the prestigious D’Aria Wine Estate.

Read more...
SMART Estate Security returns to KZN
Nemtek Electric Fencing Products Technews Publishing Axis Communications SA OneSpace Editor's Choice News & Events Integrated Solutions IoT & Automation
The second SMART Estate Security Conference of 2024 was held in May in KwaZulu-Natal at the Mount Edgecombe Estate Conference Centre, which is located on the Estate’s pristine golf course.

Read more...
Dynamic Dashboard enhances security and operational efficiency
Suprema neaMetrics Products & Solutions Integrated Solutions Residential Estate (Industry)
In today’s data-driven world, security systems are overwhelmed by an unprecedented volume of data, from video surveillance and access control logs to intrusion alerts and a variety of IoT sensor data.

Read more...
HELLO visitor access management
Products & Solutions Access Control & Identity Management Integrated Solutions Residential Estate (Industry)
HELLO is an on-premises visitor and contractor access management solution designed to be fully integrated and complementary with smart, on-trend technologies, securing estates and businesses alike.

Read more...
Using KPIs to measure smart city progress
Axis Communications SA Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
United 4 Smart Sustainable Cities is a United Nations Initiative that encourages the use of information and communication technology (including security technology) to support a smooth transition to smart cities.

Read more...
Enhancing estate security, the five-layer approach
Fang Fences & Guards Residential Estate (Industry) Integrated Solutions Security Services & Risk Management
Residential estates are designed to provide a serene and secure living environment enclosed within gated communities, offering residents peace of mind and an elevated standard of living.

Read more...
Creating employment through entrepreneurship
Technews Publishing Marathon Consulting Editor's Choice Integrated Solutions Residential Estate (Industry)
Eduardo Takacs’s journey is a testament to bona fide entrepreneurial resilience, making him stand out in a country desperate for resilient businesses in the small and medium enterprise space that can create employment opportunities.

Read more...
Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Read more...
Dallmeier receives ISO 27001 certification
Dallmeier Electronic Southern Africa Surveillance News & Events
Dallmeier has received ISO 27001 certification for its Information Security Management System (ISMS). The international standard for information security management ensures that companies meet the highest standards of data protection and data security.

Read more...